{"record":{"id":"ccb0755e6ad5f258","repo":"paperclipai/paperclip","slug":"no-auth-user-has-an-instance-admin-role-and-active","errorCode":null,"errorMessage":"No auth user has an instance-admin role and active company membership for local-trusted worktree seeding.","messagePattern":"No auth user has an instance-admin role and active company membership for local-trusted worktree seeding\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"cli/src/commands/worktree.ts","lineNumber":1621,"sourceCode":"          eq(companyMemberships.principalType, \"user\"),\n          eq(companyMemberships.principalId, authUsers.id),\n          eq(companyMemberships.status, \"active\"),\n        ),\n      )\n      .where(and(\n        expected ? eq(authUsers.id, expected.adminUserId) : undefined,\n        requiredCompanyId ? eq(companyMemberships.companyId, requiredCompanyId) : undefined,\n        requiresCredentialAccount\n          ? and(\n              sql`length(trim(${authAccounts.providerId})) > 0`,\n              sql`length(trim(${authAccounts.accountId})) > 0`,\n            )\n          : undefined,\n      ))\n      .limit(1)\n      .then((rows) => rows[0] ?? null);\n    if (!admin) {\n      throw new Error(\n        requiresCredentialAccount\n          ? \"No auth user has a non-empty credential account, instance-admin role, and active company membership. Authenticated worktree seeding requires a credential-backed instance administrator.\"\n          : \"No auth user has an instance-admin role and active company membership for local-trusted worktree seeding.\",\n      );\n    }\n\n    const representative = await db\n      .select({ companyId: companies.id, issueId: issues.id })\n      .from(companies)\n      .innerJoin(issues, eq(issues.companyId, companies.id))\n      .where(\n        and(\n          expected ? eq(companies.id, expected.representativeCompanyId) : undefined,\n          expected ? eq(issues.id, expected.representativeIssueId) : undefined,\n          requiredCompanyId ? eq(companies.id, requiredCompanyId) : undefined,\n        ),\n      )\n      .limit(1)","sourceCodeStart":1603,"sourceCodeEnd":1639,"githubUrl":"https://github.com/paperclipai/paperclip/blob/a7e689b3c35347b529cb9f54c9b9a8575a3dcab6/cli/src/commands/worktree.ts#L1603-L1639","documentation":"The other branch of the same seed-validation throw, used for local-trusted seeding: the query found no auth user with the instance-admin role and an active company membership at all (credential-account filters not applied). The seed needs at least one acting administrator with a membership to stamp into the seeded copy's expectation. Optional expected admin id and required company filters can also exclude every candidate.","triggerScenarios":"ensureWorktreeSeeded's validation with requiresCredentialAccount=false against a source DB with no instance-admin + active-membership row — e.g. a brand-new instance that never finished onboarding, or stale expected admin/company ids.","commonSituations":"Seeding from a fresh instance before onboarding created the CEO/admin user; memberships deactivated; expected ids from an old manifest pointing at deleted users.","solutions":["Onboard the source instance (create the admin user and an active company membership), then retry the seed","Remove or refresh the stale seed expectation (expected adminUserId) so validation is not pinned to a deleted user","If the source is genuinely empty, seed the source itself first or choose a healthy source instance"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"-- pre-check before local-trusted seeding\nSELECT 1\nFROM auth_users u\nJOIN company_memberships m ON m.user_id = u.id AND m.status = 'active'\nWHERE u.role = 'instance-admin'\nLIMIT 1; -- zero rows = seed will fail","typeGuard":null,"tryCatchPattern":"Catch and surface 'onboard the source instance first (create an admin with an active membership)' as the remediation.","preventionTips":["Finish onboarding on the source instance before using it as a seed origin","Re-derive stale seed expectations instead of pinning deleted admin user ids"],"tags":["auth","worktree","seed","admin","database"],"backgroundTag":"missing-admin-user","analyzedSha":"a7e689b3c35347b529cb9f54c9b9a8575a3dcab6","analyzedAt":"2026-08-21T17:58:32.592Z","schemaVersion":2},"datasetVersion":"2026-08-22T09:17:25.309Z"}